Apache Syncope EUVD-2026-45962

Exploitation requires the deployment to be configured with the all-Java user workflow adapter, OR the Flowable user workflow adapter with a BPMN definition that does NOT require admin approval for user self-registration or self-update. Under either condition, an attacker submits a REST API self-registration/self-update call that assigns themselves defined Roles. Limiting factors: the non-default requirement that self-service actions bypass admin approval means hardened deployments (Flowable BPMN enforcing approval) are not exploitable; the concrete privilege gained is bounded by which Roles/Entitlements are actually defined on that Syncope instance; and while the self-registration path may be reachable pre-authentication, the self-update path presumes an existing low-privileged account.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) reflects network-reachable, low-complexity abuse yielding full administrative control, which is the worst-case ceiling. That ceiling is real only where the vulnerable configuration exists: the all-Java adapter, or a Flowable BPMN that skips admin approval for self-registration/self-update - so real-world risk is gated by deployment configuration rather than being universal, a nuance the raw 9.8 does not capture. PR:N is defensible because the self-registration path can be reachable without a prior account, though the self-update path realistically implies an existing low-privileged session (closer to PR:L); the input provides no SSVC decision and no EPSS score, so automatability and observed-exploitation probability cannot be quantified here. There is no KEV listing and no evidence of a public POC, so this is a high-severity-but-not-yet-exploited priority: patch promptly given trivial exploitation and total-compromise impact, but the config dependency means not every Syncope instance is equally exposed - verify each deployment's workflow adapter and BPMN approval settings.

On a Syncope instance using the all-Java adapter (or a Flowable BPMN without admin approval), an attacker self-registers or authenticates as an ordinary user and submits a crafted REST self-registration/self-update request that includes one or more privileged Roles. Because the workflow does not strip or gate the Role assignment, the account is provisioned with those Roles' Entitlements, granting de facto administrator access; no public POC has been identified, but the low-complexity network vector makes exploitation straightforward for anyone who can reach the API.